# puppet01

Runs the puppet server for rhel7

The main code repositories are synced into:

* /srv/puppet/code/base/preprod/
* /srv/puppet/code/base/prod/

Other optional environments can be arbitrarily created and immediately used under this path:

* /srv/puppet/code/dev/envs/

At https://puppet01.psi.ch/ , a small web app to delete server side certificates is made available. The authentication uses LDAP against the AD, but access rights are granted from the /etc/httpd/conf.d/ssl.conf

# Branches

You can create a branch to develop new code from the master branch of the puppet repository. To test the code, a directory with the same name as the branch can be created at puppet01:/srv/puppet/code/dev/envs/ . Upon creating the directory, preprod gets rsynced in here. If the branch alrady exists and if it's to be pulled, that can be done via the command:

```
git pull origin xyz
```

This can then be tested on any controlled host by running:

```
puppet agent -t --environment=xyz
```

# Merge Process

Merge meetings are usually held weekly. To record the meeting a https://git.psi.ch/linux-infra/org/wikis/meeting_reports/YYYY-MM-DD page is to be created based on the https://git.psi.ch/linux-infra/org/wikis/merge-meeting-guidelines template.

# Modules

The modules, which are not part of the base repo are to be pulled into /srv/puppet/code/dev/envs/(pre)prod/code/modules/

The correct way to pull the modules is with the use of librarian. However, at this time, the puppetfile contains "prod" or "production" as versions for some of the modules. Librarian can not understand this. As a result, it turns to the puppetfile.lock , where the commit of the initial pull is saved. As long as the lock is present, librarian will always pull the commit saved there, it will not pull the latest commit and will even revert, if that latest commit is pulled manually.

The solution is to always run librarian with the lock file removed:

```
[root@puppet01 prod]# cd /srv/puppet/code/base/prod
[root@puppet01 prod]# rm -f Puppetfile.lock
[root@puppet01 prod]# /opt/puppetlabs/puppet/bin/librarian-puppet install --path=code/modules
```

This way the latest commit will be pulled for all incorrectly defined modules.

# Hiera / data-xxx 
The data-xxx repositories have a webhook configured that points to http://puppet01.psi.ch/events/dataupdate
The triggered webhook code can be found on puppet01 at /var/www/webhook/app/webhook.py

This webhook checks out the data repositories in /srv/puppet/data
